Assessment item 4
Security Management and Migration
Value: 20%
Due date: 27-May-2018
Return date: 20-Jun-2018
Submission method options
Alternative submission method
Task
Regional Gardens Ltd is a company that runs a number of related gardening enterprises. It has a large display garden that it opens for public inspection a number of times a year. These enterprises include the Regional Gardens Nursery which sells plants and garden supplies to the public, and Regional Garden Planners which provides garden advice, design and consultancy services.
The company is considering the following strategic proposal:
They plan to retain the Bathurst data centre for data storage. This would entail updating their Active Directory and data storage infrastructure, and moving all other infrastructure into the Cloud.
They plan to initially move all their Web Services into the Cloud in order to provide an increased level of HA (High Availability) as well as a better degree of flexibility in supplying data to their customers and employees. This would entail changing their current web software architecture to take advantage of the flexibility and scalability that can be gained by moving to a Microservices model (this would entail the use of such services as AWS Lambda or Azure Functions, Containers, Data Services, and Cloud Edge capability and monitoring).
They also plan to migrate their LoB (Line of Business) applications to a Cloud Infrastructure to increase their flexibility and availability.
The Board of Regional Gardens is contemplating this strategy as a way to increase the company’s flexibility and responsiveness. The Board also expects to achieve significant savings on the cost of maintaining their ICT infrastructure by closing their existing data centre. They appreciate that this would entail retraining for their existing ICT staff so that they can manage the new Cloud based infrastructure.
Regional Gardens has again approached you to advise them on this strategy. You have already advised Regional Gardens that this strategic approach will mean that they will need to ultimately design and operate a “Hybrid Cloud” methodology, where part of their data centre is “on premise” and another part in a Cloud.
Regional Gardens also plan to run a Risk and Security Workshop to assess the risks, security issues and possible methods of control that will be required with this “Hybrid Cloud” approach. You will be required to organise, run and facilitate this workshop.
The Board is also concerned about how this strategy will affect their BCP (Business Continuity Plan) and their backup and disaster recovery strategies.
Tasks
Your team has been engaged to provide a risk assessment for MetaSoft in their planned move to a Hybrid Cloud strategy.
Team Setup
This assignment is a team assignment. The rationale for using a team approach is that most IT risk management assessments are normally done by teams of between 2-5 Architects, Information Security experts, Operations and Business leaders for each problem. You will be assigned to a team and the team, as a whole, will be responsible for the development of the risk assessment.
Team Member Responsibilities
Each team member will be assessed on:
The final risk assessment presented by the team;
The individual contributions that they have made to the risk assessment. This will be shown by the entries that they have made in the Team forum;
Team members should note that:
A total of 20% of the total marks for this assignment are for individual contributions. These include:
Selection of issues for risk assessment (10%), and
Reasoning behind the risk assessment for the selected issues (10%)
A team member without any individual contributions in the Team Forum will be regarded as having not contributed to the risk assessment. This will result in either reduced marks or no marks being awarded to that team member for this assignment.
The tasks:
Your team’s task is to prepare a report for Regional Gardens that discusses the following:
Describe which Cloud architectures you would employ to assist Regional Gardens to meet the Board’s strategy?
Describe each of the architectures that you would use, along with your reasons for deploying it. (10 marks)
Describe the benefits and issues that would be the result of your deployment of these architectures. (10 marks)
Describe the risks that you see associated with this new Hybrid Cloud and Microservices strategy. You should name and describe each risk that you identify, and then describe a possible control for the risk. This should be presented in a tabular form. (20 marks)
Describe the general Information Security steps and controls that you would recommend to the Board to secure the Hybrid Cloud. You will need to explain to the Board your reasons for recommending these particular security steps. (20 marks)
Discuss briefly what you would recommend should be included in Regional Gardens’s BCP as a result of their adoption of a Hybrid Cloud and Microservices approach. You will need to consider, as a minimum, the issues of application resilience, backup and disaster recovery in a Hybrid Cloud environment. This section should be no more than 2 pages. (10 marks)
Discuss the requirements that Regional Gardens will need to consider in order to conduct remote server administration, resource management and SLA management for its proposed IaaS and PaaS instances (it may be useful to consider Morad and Dalbhanjan’s operational checklists for this section). This section should be no more than two to three pages in length. (10 marks)
The Regional Gardens board has also decided to move their eMail instance to the AWS cloud in order to begin the migration process, and test their strategy.
Describe the steps that you would include in the plan to migrate these services. (10 marks)
What are the critical points and issues that you see occurring at each of these steps? Explain why you see these points or issues as critical. (10 marks)
Rationale
This assessment will cover the following outcomes:
Be able to compare and evaluate the ability of different Cloud Computing Architectures to meet a set of given business requirements;
Be able to evaluate a set of business requirements to determine suitability for a Cloud Computing delivery model;
Be able to evaluate and design an ICT Risk Management strategy for a Cloud Computing Delivery plan to meet business requirements;
Be able to interpret, evaluate and plan the Governance and Security requirements for a Cloud Computing delivery plan;
Be able to analyse and evaluate business requirements to plan a migration to a Cloud model;
Marking criteria
Marking Criteria

Assessment Rubric
Questions HD DI CR PS FL
1. Architectures Clear and comprehensive description of Cloud architectures needed, benefits and critical points identified & discussed Detailed description of Cloud architectures needed, most benefits and critical points identified & discussed Good description of Cloud architectures needed, many benefits and critical points identified & discussed Adequate description of Cloud architectures needed, some benefits and critical points identified & discussed Inadequate or incomplete description of Cloud architectures needed, few or no benefits or critical points identified & discussed
2. Risk Assessment Clear, comprehensive description of Risk Management issues, critical points identified & discussed, Detailed description of Risk Management issues, many critical points identified & discussed, Good description of Risk Management issues, many critical points identified & discussed, Adequate description of Risk Management issues, some critical points identified & discussed, Inadequate or incomplete description of Risk Management issues, critical points identified & discussed,
3. Information Security Clear, comprehensive assessment of InfoSec issues, critical points identified & discussed, Detailed assessment of InfoSec issues, most critical points identified & discussed, Good assessment of InfoSec issues, many critical points identified & discussed, Adequate assessment of InfoSec issues, some critical points identified & discussed, Inadequate or incomplete assessment of InfoSec issues, few or no critical points identified & discussed,
4. Changes to BCP Clear, comprehensive description of backup and DR plan, critical points identified & discussed, Detailed description of backup and DR plan, critical points identified & discussed, Good description of backup and DR plan, some critical points identified & discussed, Adequate description of backup and DR plan, some critical points identified Inadequate or incomplete description of backup and DR plan, none or few critical points identified
5. Hybrid Cloud Management Clear, comprehensive assessment of service management, critical points identified & discussed, Detailed assessment of service management, most critical points identified & discussed, Good description of service management, some critical points identified & discussed, Adequate description of service management, some critical points identified Incomplete or inadequate description of service management, none or few critical points identified
6. Migration Plan Clear and thorough description of the steps required to migrate to a Hybrid Cloud, issues and critical points and issues identified Detailed description of the steps required to migrate to a Hybrid Cloud, most issues and critical points and issues identified Good description of the steps required to migrate to a Hybrid Cloud, many issues and critical points and issues identified Adequate description of the steps required to migrate to a Hybrid Cloud, some issues and critical points and issues identified Inadequate or incomplete description of the steps required to migrate to a Hybrid Cloud, few or no critical points or issues identified
Quality of forum interaction Proactively initiates and facilitates discussion, explicitly using appropriate strategies and tools. Initiates and facilitates discussion using appropriate strategies and tools. Evidence that there is a planned strategy to engage with peers in the forums. Some evidence of responding to questions or topics on the discussion forum. No evidence of interaction on forums.
Referencing Up to 5 marks may be deducted for not providing or following the proper APA style of referencing. (Note that the guide for APA referencing is provided in the Resource Section of the ITC561 Interact site)
Spelling Presentation and Grammar Up to 5 marks may be deducted for poor presentation, spelling and grammar

Presentation
The team is to provide a written report with the following headings:
Proposed Architectures for a Hybrid Cloud
Risk report for Hybrid Cloud and Microservices
Proposed Information Security controls
BCP Changes
Hybrid Cloud Administration and SLA Management
SharePoint Migration Planning
As a rough guide, the report should not be longer than about 6,000 words. The report is to be loaded into the Team Resource area in Interact.
All risk assessment discussions in the team forum should be exported into a single document and loaded into the Team Resource area in Interact.
It is suggested that the report should be written using Google Docs using MS Word format. Google Docs allows multiple authors to contribute to a single document, and their individual contributions can be more easily assessed.

Your team report MUST be presented in MS Word format. Your team report should:
Use Calibri, or a similar font, in 11 or 12 point type.
All diagrams and images are to be embedded in the document. Diagrams and images that are suppliued separately will not be marked.
All text should be left-justified.
Each page must have a header or footer with your name and student number. Page numbers must be shown in the footer of each page, except on the title page.
Reports are marked and feedback attached using a MS Word based tool. Reports that are submitted in PDF format will be re-formatted to Word format in order to be marked. Allowances will not be made for any loss of information, diagrams or images as a result of the re-formatting.